Cisco NX-OS Improper Input Validation (CVE-2017-12338)

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerability is due to insufficient input validation for a specific CLI command. An attacker could exploit this vulnerability by issuing a crafted...

Wowza Media Systems Wowza Streaming Engine 路径遍历漏洞

Wowza Media Systems Wowza Streaming Engine is a powerful, customizable and extensible media server software from Wowza Media Systems, USA. It is used to reliably stream high-quality video and audio to any device, anywhere. A path traversal vulnerability exists in Wowza Media Systems Wowza Streami...

TRCore DVC 安全漏洞

TRCore DVC is a file insurance system from TRCore China. TRCore DVC suffers from a path traversal vulnerability that stems from the program's failure to properly filter special elements in the path of a resource or file, which can be exploited by an attacker to read arbitrary system files...

PT-2024-16901 · Trcore · Dvc

Name of the Vulnerable Software and Affected Versions: DVC from TRCore affected versions not specified Description: The issue allows unauthenticated remote attackers to exploit a Path Traversal vulnerability, enabling them to read arbitrary system files. Recommendations: At the moment, there is n...

Craft CMS 安全漏洞

Craft CMS is a content management system CMS open source by Craft CMS. A security vulnerability exists in Craft CMS that stems from the ability to decode a Base64 payload, which allows an attacker to read arbitrary files on the server...

PT-2024-18679 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a...

PT-2024-31028 · Apple · Macos Sequoia +1

Name of the Vulnerable Software and Affected Versions: macOS Sequoia versions prior to 15.1 Description: A logic issue was addressed with improved validation. This issue allows an app to potentially read arbitrary files. The estimated number of potentially affected devices worldwide is not...

CVE-2024-20379

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability exists becau...

PT-2024-39668 · WordPress · The Contact Form By Bit Form

Name of the Vulnerable Software and Affected Versions: The Contact Form by Bit Form plugin for WordPress versions up to, and including, 2.15.2 Description: The issue arises from improper input validation within the iconUpload function, allowing authenticated attackers with Administrator-level...

PT-2024-38022 · Unknown · Parisneo/Lollms-Webui +1

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified parisneo/lollms affected versions not specified Description: A path traversal issue exists due to improper sanitization of the personality folder parameter in the "api open personality...

The vulnerability of the Palo Alto Networks Expedition configuration migration tool lies in the lack of security measures for SQL query structures. This allows attackers to access database contents, create, and read arbitrary files.

The vulnerability of the Palo Alto Networks Expedition configuration migration tool lies in the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to remotely access database contents, create and read arbitrary files by injecting specially...

VulnCheck KEV: CVE-2023-33510

Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters...

CVE-2024-8688

An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface CLI enables authenticated administrators including read-only administrators with access to the CLI to to read arbitrary files on the firewall...

VulnCheck KEV: CVE-2023-6023

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifactpath URL parameter...

PT-2024-31591 · Hoverfly · Hoverfly

Name of the Vulnerable Software and Affected Versions: Hoverfly affected versions not specified Description: The /api/v2/simulation POST handler in Hoverfly allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read...

PT-2024-7509 · Onedev · Onedev

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 11.0.9 Description: A vulnerability in OneDev allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9. The vulnerability is related to...

CVE-2024-38653

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server...

CVE-2024-7480

An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface CLI user with administrative privileges to read arbitrary files on the system. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version v9.6, which can be exploited to bypass protection by changing the root folder to /, allowing an attacker to read arbitrary files on the system...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version 9.6 that stems from a lax CORS policy. An attacker could use this vulnerability to read arbitrary files on the system and wri...